1. Roles and scope
This Data Processing Agreement forms part of the Terms & Conditions between the customer (the "Controller" — the tenant/workspace owner) and Kedaya Tech LLP (the "Processor", "we"). It governs our processing of personal data the Controller submits to Salesman Tracker ("Tenant Data") on the Controller's behalf. We process Tenant Data only on the Controller's documented instructions (the Terms, this DPA, and use of the product's features), except where law requires otherwise. Subject matter: provision of the service; duration: the subscription term plus the deletion window in section 6; data subjects: the Controller's employees and its customers/leads; categories: names, phone numbers, emails, addresses, location, photos, and order/payment records. The Controller must not upload special-category data.
2. Our obligations
We will process only on instructions; ensure personnel are bound by confidentiality; apply the security measures in section 4; assist the Controller with data-subject requests and, where relevant, with impact assessments; make available the information needed to demonstrate compliance; and not process Tenant Data for our own purposes (no advertising, no cross-tenant use, no AI-model training).
3. Sub-processors
The Controller authorises the sub-processors listed on our Sub-processors page. We impose data-protection terms on each that are no less protective than this DPA and remain responsible for their performance. We will give 30 days' notice of any new sub-processor; the Controller may object on reasonable data-protection grounds.
4. Security
We maintain appropriate technical and organisational measures, including TLS in transit, hashed passwords, role-based access control, audit logging of administrative actions, and signed, expiring URLs for media. We keep these measures under review and update them as appropriate.
5. Data-subject and authority requests; breach
If we receive a request from a data subject or authority regarding Tenant Data, we will (unless prohibited) direct it to the Controller and assist in responding, including via the product's export and deletion tools. We will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Tenant Data, with the information the Controller needs to meet its own notification duties.
6. Return and deletion
On termination the Controller can export Tenant Data for 30 days; after that we delete it and instruct sub-processors to do the same, except where law requires retention (for example invoices).
7. International transfers
Where Tenant Data is transferred across borders (for example to our hosting region in India), the transfer relies on an approved mechanism — standard contractual clauses, adequacy, or consent — as applicable.
8. Audits, liability and precedence
We will make compliance information available and, subject to confidentiality and reasonable notice, allow the Controller (or an auditor) to verify compliance. Liability under this DPA is subject to the limitations in the Terms; where this DPA conflicts with the Terms on data protection, this DPA prevails for Tenant Data. Processor: Kedaya Tech LLP, Rajkot, Gujarat, India · legal@salesmantracker.com.